PT-2024-20318 · Supabase · Supabase Postgresql

Zhongdongxu · Published 2024-02-08 · Updated 2024-08-21 · CVE-2024-24213

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Supabase PostgreSQL version 15.1

Description A SQL injection issue was discovered via the component /pg meta/default/query. However, the vendor's position is that this is an intended feature, existing in the Supabase dashboard product for authorized users to enter SQL queries in a designated UI, with no injection occurring.

Recommendations For Supabase PostgreSQL version 15.1, consider restricting access to the /pg meta/default/query component to authorized users only, as it is intended for use within a specific UI. Additionally, ensure that all SQL queries entered through this component are thoroughly validated and sanitized to prevent any potential issues. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-POSTGRESQL-2024-24213

CVE-2024-24213

Affected Products

Supabase Postgresql

References · 13

• 🔥 https://github.com/940198871/Vulnerability-details/blob/main/CVE-2024-24213 · Exploit
• https://osv.dev/vulnerability/BIT-postgresql-2024-24213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24213 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24213 · Vendor Advisory
• https://supabase.com/docs/guides/database/overview#the-sql-editor · Vendor Advisory
• https://postfixadmin.ballardini.com.ar:8443/project/default/logs/explorer. · Note
• https://app.flows.sh:8443/project/default%2C · Note
• https://t.me/cvenotify/91607 · Telegram Post
• https://t.me/cvenotify/88386 · Telegram Post
• https://reference1.example.com/project/default/logs/explorer%2C · Note
• https://twitter.com/CVEnew/status/1755657275195166729 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1755675400699621466 · Twitter Post
• https://t.me/cvenotify/72967 · Telegram Post